Using Plexavo
in Claude Code.
This is a new interface, not a new engine. Same deterministic scan, same score, same findings, just a conversational front end on top of the Plexavo you already trust.
$ /plugin install plexavo-scan@plexavo
Ask in plain language.
Get a real scan.
No flags to memorize, no config file to write first. The flow is the same one you would run yourself from the CLI.
Lists your profiles
Reads your configured AWS profiles and asks which one to use. It never assumes.
Confirms it's live
Checks that the chosen profile actually has working credentials before doing anything else.
Runs the real scan
The same deterministic Plexavo scan, against your real AWS account.
Reports, in order
Score, then attack path if one exists, then prioritized findings, with the full list on request.
What it will,
and won't do.
This is the part that actually differentiates a conversational front end from a scanner that makes its own calls.
- It relays exactly what Plexavo found. It never invents or independently judges anything.
- It will not run a state-changing AWS command, like blocking public access or rotating a key, without you explicitly saying yes to that specific command.
- It will not silently pick an AWS profile for you.
- It will not tell you your account is "secure" or "clean," only the real score and rating, caveats included.
- It will say plainly when something wasn't checked or isn't fully covered, rather than implying broader coverage than what was actually scanned.
Score, attack path,
then the fix.
Trimmed from an actual transcript. Nothing here is staged.
default and staging. Which one should I use?
default
Confirmed, credentials are live. Running the scan now.Score: 61 / 100 (Moderate risk).
Attack path found: a public S3 bucket holds credentials an EC2 role can read, which has admin access.
Top finding: S3 bucket "app-uploads" is publicly readable. Fix command:
aws s3api put-public-access-block ...I won't run this unless you say so. yes, run it Running the fix command now. Confirming the block is applied before moving to the next finding.
Three things,
nothing new.
- Plexavo
- Installed already. See the main install section if it isn't yet.
- Claude Code
- Installed and signed in on your machine.
- AWS credentials
- Configured locally, the same profiles Plexavo would use from the CLI.
Stated plainly,
not buried.
Same single-account, one-hop scope as the rest of Plexavo. Nothing about the Claude Code interface changes that.
- No MCP server yet. This is a Claude Code plugin, not a standalone protocol server.
- No multi-hop cross-account chains. One account, one hop, same as everywhere else in Plexavo.
A manual path
works too.
Skip the plugin marketplace and add the skill file directly.
Save plugins/plexavo-scan/SKILL.md to: ~/.claude/skills/plexavo-scan/SKILL.md (%USERPROFILE%\.claude\skills\plexavo-scan\SKILL.md on Windows)
Works with Claude Code. Built by Plexavo.
Plexavo runs through Claude Code as an installable plugin. It is not built, endorsed, or operated by Anthropic.